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FISA Business Records Telephony Metadata Collection 


Verification Requirement: 
Verify that the data is of the type authorized by the order (i.e., call-detail records/ 
telephony metadata). (See page 2 of the Order.) 
Under no circumstances may the substantive content of communications 
be received under this order. 


Specific Court-Ordered Procedures and Restrictions (see pages 5-12 of the Order): 


Standard for Accessing Data 


Any search or analysis of the data archive shall occur only after a particular 
known telephone number has been associated with | 


Seed queries must be particular known telephone numbers that 
meet the targeting standard articulated by the Court --based on the factual and 
practical considerations of everyday life on which reasonable and prudent persons 
act, there are facts giving rise to a reasonable, articulable suspicion that the 


telephone number is associated with ae. 


provided, however, that a telephone number believed to be used by a U.S. person 


shall not be regarded as associated with 
sll not be evaded as associated wih solely 


on the basis of activities that are protected by the First Amendment to the 
Constitution. (See Order, § 3(A).) 


No targeting U.S. persons based upon 1* Amendment protected activities. 


OGC must review and approve targeting of U.S. persons to ensure that 
standards are met. 


Other Access Requirements 


Access to this data is limited to authorized analysts. NSA’s OGC shall monitor 
the designation of individuals with access to the archive.: Access to the archive 
shall be controlled by user name and password. When the metadata archive is 
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accessed, the user’s login, IP address, date and time, and retrieval request shall be 
automatically logged for auditing capability. 


All queries must have prior approval of one of the following: 


a) SID Program Manager for Counterterrorism Special Projects 
b) Chief, Homeland Security Analysis Center 

c) Deputy Chief, Homeland Security Analysis Center 

d) Homeland Mission Coordinator 


The above individuals must establish management controls for access to the data. 
Automatic log must be generated for each occasion when the info is accessed. 


Log must contain: a) user login, b) user IP address, c) date and time, d) retrieval 
request. 


Manner of Accessing Data 


NSA is permitted to perform two sorts of queries: 1) contact chaining to a third 
tier of contacts, and 2) 


Storage 


Metadata must be stored and processed on a secure private network that NSA 
exclusively will operate. 


Metadata received under this Order may be kept online for 5 years and then 
destroyed. 


Training & Oversight 


OGC must train analysts concerning the authorization and querying standard, as 
well as other procedures and restrictions regarding the retrieval, storage, and 
dissemination of the archived data. 


OGC must monitor the designation of individuals with access to the data and the 
functioning of the automatic logging/auditing. 


OGC must conduct two random spot checks during the authorization period to 
ensure that NSA is receiving only data as authorized by the Court and not 
receiving the substantive content of communications. 
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DoJ shall conduct a review at least twice every 90 days of a sample of NSA’s 
queries against the data. 


The IG, OGC and SID Oversight must periodically review the program. 


Minimization Rules 
USSID 18 minimization procedures must be applied to the activity. 


Prior to dissemination of any U.S. person identifying information, the Chief of 
Information Sharing Services must determine that information identifying U.S. 
persons is related to counterterrorism information and that it is necessary to 
understand or assess the counterterrorism information. 


Duration of Authorization 


FISC order is valid for 90 days. 


Reporting and Renewal Requirements 


NSA must file a report every 45 days with the Court that includes: 


1. the queries that have been made since this Order was granted; 

2. the manner in which NSA applied the standard required by the Court 
for accessing the data, and 

3. any proposed changes in the way in which the call-detail records | 
would be received. 


